chore(deps): bump the minor-and-patch group across 1 directory with 6 updates by dependabot[bot] · Pull Request #21 · thaw-app/platform

dependabot · 2026-09-21T16:54:55Z

Bumps the minor-and-patch group with 6 updates in the / directory:

Package	From	To
@pulumi/pulumi	`3.257.0`	`3.263.0`
es-toolkit	`1.50.0`	`1.52.0`
valibot	`1.4.2`	`1.5.0`
@biomejs/biome	`2.5.8`	`2.5.14`
@types/bun	`1.3.14`	`1.4.2`
@valibot/to-json-schema	`1.7.1`	`1.8.0`

Updates @pulumi/pulumi from 3.257.0 to 3.263.0

Release notes

Sourced from @pulumi/pulumi's releases.

v3.263.0

3.263.0 (2026-09-15)

Bug Fixes

[cli/deployment] Stop pulumi deployment settings edit overwriting the source of stacks that use a provider other than GitHub, take --path-filter once per filter rather than splitting it on commas, and report an unconfigured stack from get instead of failing #24526

[engine] Fix remote component provider state migrations being skipped when the caller also supplies migrations #24620

[engine] Forward caller error hooks to remote component providers #24622

[cli/do] Error sooner if string values can't be cast to numeric/boolean inputs #24643

[build] Restore pr# based downloads #24649

[sdk/nodejs] Fix a panic in the pnpm package manager when pnpm config get allowBuilds prints null #24674

Improvements

[cli] Document automatic plugin installation and list the valid KIND values in pulumi plugin install --help #24630

[cli/plugin] Describe what pulumi plugin ls does and does not list in its help text #24631

[cli] Reframe pulumi plugin help around automatic plugin installation and link the plugin-authoring docs #24632

[cli] Protect resources retained by pulumi state promote so a subsequent update cannot delete them before the generated code is added to the program #24640

[cli/env] Prompt for the ESC project and environment names in pulumi env setup, ask how to authenticate before choosing an access level, and print a success message when setup completes #24662

Miscellaneous

[java] Upgrade java to v1.37.1 #24659

[hcl] Upgrade hcl to v0.18.0 #24659

[yaml] Upgrade yaml to v1.38.6 #24661

[sdk/dotnet] Upgrade dotnet to v3.113.3 #24672

v3.262.0

3.262.0 (2026-09-10)

Features

[engine] Support importing a pulumi:index:Stash resource. The stash adopts the given id and holds a null value, and the program's configured input then applies as an update #24544

Bug Fixes

[auto/go] Match wrapped errors in the Automation API error predicates, and unwrap the underlying cause #24197

[cli/deployment] Stop pulumi deployment settings edit clearing settings it was not asked to change, let --branch and --commit replace one another rather than be combined, and reject --oidc-*-clear=false instead of ignoring it #24525

[cli] Re-validate an agent account claim marked unavailable instead of trusting the stale marker forever #24495

[cli] Verify TLS certificates when downloading a template from a URL outside the configured service #24504

[engine] Propagate --target-dependents and --exclude-dependents through resources read with .get() #24538

[engine] Run state migrations for aliased remote components #24545

[engine] Sort resources deterministically when repairing a snapshot #24551

[engine] Fix state migration ordering for components interleaved with other resources #24552

[sdk] Allow Automation API project settings to use any language runtime #24559

[engine] Redact secret property values in violates plan error messages unless --show-secrets is passed #24567

[cli] Treat a resource provider attached through PULUMI_DEBUG_PROVIDERS as installed, so package installation does not try to download it #24572

[cli] Install the packages a local plugin directory requires before the plugin is installed and run #24576

[engine] Avoid a deadlock when a resource provider asks the engine to load another plugin while it boots #24571

[engine] Allow component state migrations to split managed state using compatible existing resource identities #24582

... (truncated)

Changelog

Sourced from @pulumi/pulumi's changelog.

3.263.0 (2026-09-16)

Bug Fixes

[cli/deployment] Stop pulumi deployment settings edit overwriting the source of stacks that use a provider other than GitHub, take --path-filter once per filter rather than splitting it on commas, and report an unconfigured stack from get instead of failing #24526

[engine] Fix remote component provider state migrations being skipped when the caller also supplies migrations #24620

[engine] Forward caller error hooks to remote component providers #24622

[cli/do] Error sooner if string values can't be cast to numeric/boolean inputs #24643

[build] Restore pr# based downloads #24649

[sdk/nodejs] Fix a panic in the pnpm package manager when pnpm config get allowBuilds prints null #24674

Improvements

[cli] Document automatic plugin installation and list the valid KIND values in pulumi plugin install --help #24630

[cli/plugin] Describe what pulumi plugin ls does and does not list in its help text #24631

[cli] Reframe pulumi plugin help around automatic plugin installation and link the plugin-authoring docs #24632

[cli] Protect resources retained by pulumi state promote so a subsequent update cannot delete them before the generated code is added to the program #24640

[cli/env] Prompt for the ESC project and environment names in pulumi env setup, ask how to authenticate before choosing an access level, and print a success message when setup completes #24662

Miscellaneous

[java] Upgrade java to v1.37.1 #24659

[hcl] Upgrade hcl to v0.18.0 #24659

[yaml] Upgrade yaml to v1.38.6 #24661

[sdk/dotnet] Upgrade dotnet to v3.113.3 #24672

3.262.0 (2026-09-10)

Features

[engine] Support importing a pulumi:index:Stash resource. The stash adopts the given id and holds a null value, and the program's configured input then applies as an update #24544

Bug Fixes

[auto/go] Match wrapped errors in the Automation API error predicates, and unwrap the underlying cause #24197

[cli/deployment] Stop pulumi deployment settings edit clearing settings it was not asked to change, let --branch and --commit replace one another rather than be combined, and reject --oidc-*-clear=false instead of ignoring it #24525

[cli] Re-validate an agent account claim marked unavailable instead of trusting the stale marker forever #24495

[cli] Verify TLS certificates when downloading a template from a URL outside the configured service #24504

[engine] Propagate --target-dependents and --exclude-dependents through resources read with .get() #24538

[engine] Run state migrations for aliased remote components #24545

[engine] Sort resources deterministically when repairing a snapshot #24551

[engine] Fix state migration ordering for components interleaved with other resources #24552

[sdk] Allow Automation API project settings to use any language runtime #24559

[engine] Redact secret property values in violates plan error messages unless --show-secrets is passed #24567

[cli] Treat a resource provider attached through PULUMI_DEBUG_PROVIDERS as installed, so package installation does not try to download it #24572

[cli] Install the packages a local plugin directory requires before the plugin is installed and run #24576

[engine] Avoid a deadlock when a resource provider asks the engine to load another plugin while it boots #24571

[engine] Allow component state migrations to split managed state using compatible existing resource identities #24582

[sdk/go] Allow outputs and prompt values to be marshalled into fields typed as input interfaces, such as pulumi.StringInput #24577

[backend/diy] Make sure disableSSL doesn't override explicitly specified protocols #24593

[cli] Fix pulumi install for a project that requires a resource provider attached through PULUMI_DEBUG_PROVIDERS #24604

... (truncated)

Commits

0cc2714 Fix a pnpm panic when pnpm config get allowBuilds prints null (#24674)
c9c5b7c Changelog and go.mod updates for v3.262.0 (#24624)
d5df97b Freeze v3.262.0 (#24599)
73fb177 Allow Automation API project settings to use any language runtime (#24559)
c088515 nodejs: add helper methods to transform ResourceOptions to InvokeOptions (#24...
d941fb0 Changelog and go.mod updates for v3.261.0 (#24548)
f4055a9 Freeze 3.261.0 (#24543)
f05eae6 Send OldOutputs to provider Check (#24524)
ecabf85 Preserve secret marker when serializing unknown Outputs (#24500)
0bf1a89 avoid hanging when policy pack start fails (#24492)
Additional commits viewable in compare view

Updates es-toolkit from 1.50.0 to 1.52.0

Release notes

Sourced from es-toolkit's releases.

v1.52.0

Released on August 28th, 2026.

Added the es-toolkit/iterator entrypoint, a lazy iterator module with chunk, count, dropWhile, head, iterate, partition, range, scan, takeWhile, uniqBy, and zip ([#1815]), plus cartesianProduct ([#2031]). The same functions are also available from es-toolkit/fp/iterator.

Added defer and deferAsync to es-toolkit/util. ([#2032])

Added flowAsync to es-toolkit/fp, a promise-aware left-to-right composition. ([#2033])

Added the EmptyObject, IsEqual, JSONValue, Primitive, SetOptional, SetRequired, and UnknownRecord types. ([#2044])

Fixed merge to infer the deep merged return type, and exported the Merge type. ([#1959])

Fixed omitBy and pickBy to type numeric callback keys as strings, and exported the ObjectKeys type. ([#2037])

Fixed attempt and attemptAsync to default their error type parameter to unknown. ([#2052])

The following bring es-toolkit/compat closer to Lodash. Behavior for the affected edge cases now matches Lodash, so results may differ if you relied on the previous output.

Fixed compat/debounce to skip the maxWait invocation when both leading and trailing are false. ([#1678])

Fixed compat/toString to convert objects with a custom valueOf. ([#2034])

Fixed compat/mergeWith to assign null values in array sources. ([#1929])

Fixed compat/has and compat/hasIn to normalize the -0 path key. ([#2035])

Fixed compat/differenceWith and compat/without to normalize -0 to 0. ([#2049])

Fixed compat/findLastIndex to convert fromIndex to an integer. ([#2047])

Fixed compat/xorWith to match Lodash when no comparator is given. ([#2057])

Covered the new iterator entrypoints in the dist and browser compatibility checks. ([#2030])

Made the agent skills portable when installed on their own. ([#2054])

Fixed documentation typos and the Deno install commands. ([#2062])

v1.51.0

Released on August 17th, 2026.

Added the es-toolkit/bigint entrypoint: bigint counterparts of the math functions (sum, sumBy, max, min, maxBy, minBy, clamp, inRange, median, medianBy, percentile, range, rangeRight), kept separate so the number implementations stay unchanged. ([#1966])

Added dedent, which removes common leading whitespace from template strings. ([#1679])

Added deepFreeze for recursively freezing objects. ([#1680])

Added mapValuesAsync and mapKeysAsync. ([#1544])

... (truncated)

Changelog

Sourced from es-toolkit's changelog.

Version v1.52.0

Released on August 28th, 2026.

Added the es-toolkit/iterator entrypoint, a lazy iterator module with chunk, count, dropWhile, head, iterate, partition, range, scan, takeWhile, uniqBy, and zip (#1815), plus cartesianProduct (#2031). The same functions are also available from es-toolkit/fp/iterator.

Added defer and deferAsync to es-toolkit/util. (#2032)

Added flowAsync to es-toolkit/fp, a promise-aware left-to-right composition. (#2033)

Added the EmptyObject, IsEqual, JSONValue, Primitive, SetOptional, SetRequired, and UnknownRecord types. (#2044)

Fixed merge to infer the deep merged return type, and exported the Merge type. (#1959)

Fixed omitBy and pickBy to type numeric callback keys as strings, and exported the ObjectKeys type. (#2037)

Fixed attempt and attemptAsync to default their error type parameter to unknown. (#2052)

The following bring es-toolkit/compat closer to Lodash. Behavior for the affected edge cases now matches Lodash, so results may differ if you relied on the previous output.

Fixed compat/debounce to skip the maxWait invocation when both leading and trailing are false. (#1678)

Fixed compat/toString to convert objects with a custom valueOf. (#2034)

Fixed compat/mergeWith to assign null values in array sources. (#1929)

Fixed compat/has and compat/hasIn to normalize the -0 path key. (#2035)

Fixed compat/differenceWith and compat/without to normalize -0 to 0. (#2049)

Fixed compat/findLastIndex to convert fromIndex to an integer. (#2047)

Fixed compat/xorWith to match Lodash when no comparator is given. (#2057)

Covered the new iterator entrypoints in the dist and browser compatibility checks. (#2030)

Made the agent skills portable when installed on their own. (#2054)

Fixed documentation typos and the Deno install commands. (#2062)

Version v1.51.0

Released on August 17th, 2026.

Added the es-toolkit/bigint entrypoint: bigint counterparts of the math functions (sum, sumBy, max, min, maxBy, minBy, clamp, inRange, median, medianBy, percentile, range, rangeRight), kept separate so the number implementations stay unchanged. (#1966)

Added dedent, which removes common leading whitespace from template strings. (#1679)

Added deepFreeze for recursively freezing objects. (#1680)

Added mapValuesAsync and mapKeysAsync. (#1544)

Added toPascalCaseKeys, toKebabCaseKeys, and toConstantCaseKeys, completing the object key casing family. (#1984)

Exported the ToCamelCaseKeys, ToPascalCaseKeys, ToSnakeCaseKeys, ToKebabCaseKeys, and ToConstantCaseKeys types. (#1651)

... (truncated)

Commits

32f4c8f chore: release v1.52.0 (#2066)
2bb189c refactor(types): rename JsonValue to JSONValue (#2065)
159d0ce fix(plugin): make skills portable when installed individually (#2054)
5330c38 build(deps): bump github/codeql-action/analyze from 4.37.7 to 4.37.8 (#2059)
ce32074 build(deps): bump github/codeql-action/upload-sarif (#2060)
34f8b71 build(deps): bump github/codeql-action/init from 4.37.7 to 4.37.8 (#2061)
df05716 fix(compat/xorWith): match lodash when no comparator is given (#2057)
4c51da7 docs: fix typos and Deno install commands (#2062)
0949c8b fix[attempt, attemptAsync]: default error type parameter to unknown (#2052)
2714363 feat(types): add seven compile-time type utilities (#2044)
Additional commits viewable in compare view

Updates valibot from 1.4.2 to 1.5.0

Release notes

Sourced from valibot's releases.

v1.5.0

Many thanks to @tats-u, @idleberg, @yslpn, @francisjohnjohnston-web, @MaxFreedomPollard, @mahirhir, @ItzXynx, @LeSingh1, @maxtaran2010, @ysknsid25, @cyyynthia, @spokodev and @sanjibani for contributing to this release.

Add codePoints, maxCodePoints, minCodePoints and notCodePoints validation actions to validate the number of Unicode code points (pull request #888)

Add ksuid validation action to validate KSUIDs (pull request #1370)

Change Standard Schema properties to use eager initialization for faster schema construction and replace internal _getStandardProps utility with _standardSchema (pull request #1534)

Change url action to use URL.canParse when available to avoid constructing URL objects (pull request #1608)

Fix stringifyJson action to preserve the dataset value when JSON.stringify returns undefined (pull request #1476)

Fix literal schema and value, values, notValue and notValues actions to treat NaN as equal to itself (pull request #1573)

Fix intersect schema to merge matching NaN values and invalid dates (pull request #1573)

Fix cache and cacheAsync methods to clone the issues of a cached dataset, preventing parent schemas from adding their path item to the same issue on every cache hit (pull request #1620)

Fix strictObject, looseObject, objectWithRest and their async variants to correctly handle unknown input keys that collide with Object.prototype members (pull request #1523)

Fix intersect and intersectAsync schemas to ignore inherited properties when merging objects and preserve own properties without invoking inherited setters or changing the output prototype (pull request #1621)

Fix ulid action to reject ULIDs that exceed the maximum 128-bit value (pull request #1498)

Fix email action to reject non-ASCII characters accepted by Unicode case folding (pull request #1075)

v1.5.0 (to-json-schema)

Add support for JSON Schema draft-2020-12 and OpenAPI 3.0 Schema Object format

Add propertyNames support to record schemas for key validation constraints

Add support for toBigint, toBoolean, toDate, toNumber and toString actions for typeMode: 'input'

Add new toStandardJsonSchema function to convert Valibot schemas to Standard JSON Schema format

Change return type from JSONSchema7 to a custom JsonSchema type

Commits

5016198 chore: prepare Valibot v1.5.0 release (#1627)
1ffb038 fix(intersect): skip inherited prototype props in _merge (#1621)
1c4983f fix(ulid): restrict first character to 0-7 per ULID spec (#1498)
5e449cd perf(url): use URL.canParse for validation (#1608)
4acda1b Make sure that email validators don't match unintentional non-ASCII local par...
95943ab fix: handle object keys that collide with Object.prototype in object schemas ...
d65438c fix(cache): clone cached issues to stop issue paths from accumulating (#1620)
3ed804a dependabot: bump the github-actions group across 1 directory with 2 updates (...
0681f43 fix: use SameValueZero equality for special numeric values (#1573)
98ef8b4 Improve perf by changing ~standard implementation (#1534)
Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.8 to 2.5.14

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.5.14

2.5.14

Patch Changes
#9022 0d49e24 Thanks @dyc3! - Added the nursery rule noReturnInFinally. This rule disallows return statements in Promise.prototype.finally() callbacks, including inside nested blocks and conditional branches. Returns in nested functions are ignored by the rule.
// Invalid: return in finally callback
Promise.resolve(1).finally(() => { return 2 })
// Valid: no return in finally callback
Promise.resolve(1).finally(() => { console.log(2) })
Returning a value from a Promise.prototype.finally() callback does not replace the original promise's fulfillment value, which can be confusing. Returned promises and thenables are awaited, and their rejection rejects the resulting promise.
#11754 71eaa0d Thanks @griff-rees! - Added the nursery rule noSvelteAtDebugTags, which disallows Svelte's {@debug} tag.

{@debug user}
The {@debug} tag is a debugging aid and should be removed once you no longer need it, as it should not remain in production code. The rule provides a safe fix that removes the tag.
#11725 5eb5f09 Thanks @m1handr! - Added the nursery rule useValidTestTitle, which enforces valid titles for unit test cases and suites.

#11735 9bd70c7 Thanks @ematipico! - Fixed #8471: source.fixAll.biome ignored formatter.formatWithErrors. It now applies safe fixes without formatting files that have parse errors when the option is disabled.

#11715 f05a3c3 Thanks @ematipico! - Fixed #7771: Grit plugins that use sequential no longer panic when Biome processes files.

#11766 c2542c6 Thanks @dyc3! - Fixed validation of readonly and accessor modifiers: combining them in either order now reports that they cannot be used together.
#11461 22e9966 Thanks @FoundDream! - Fixed #11423: Multiline template interpolations now preserve the indentation of their closing brace when the source indentation is not a multiple of tabWidth.
 const value = `
      ${
        condition
          ? "yes"
          : "no"
-}
+     }
 `;
#11766 c2542c6 Thanks @dyc3! - Fixed #11763: TypeScript class members using override accessor, such as override accessor value = 1, now parse correctly. The reversed order, accessor override, now reports that override must precede accessor.

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.5.14

Patch Changes
#9022 0d49e24 Thanks @dyc3! - Added the nursery rule noReturnInFinally. This rule disallows return statements in Promise.prototype.finally() callbacks, including inside nested blocks and conditional branches. Returns in nested functions are ignored by the rule.
// Invalid: return in finally callback
Promise.resolve(1).finally(() => { return 2 })
// Valid: no return in finally callback
Promise.resolve(1).finally(() => { console.log(2) })
Returning a value from a Promise.prototype.finally() callback does not replace the original promise's fulfillment value, which can be confusing. Returned promises and thenables are awaited, and their rejection rejects the resulting promise.
#11754 71eaa0d Thanks @griff-rees! - Added the nursery rule noSvelteAtDebugTags, which disallows Svelte's {@debug} tag.

{@debug user}
The {@debug} tag is a debugging aid and should be removed once you no longer need it, as it should not remain in production code. The rule provides a safe fix that removes the tag.
#11725 5eb5f09 Thanks @m1handr! - Added the nursery rule useValidTestTitle, which enforces valid titles for unit test cases and suites.

#11735 9bd70c7 Thanks @ematipico! - Fixed #8471: source.fixAll.biome ignored formatter.formatWithErrors. It now applies safe fixes without formatting files that have parse errors when the option is disabled.

#11715 f05a3c3 Thanks @ematipico! - Fixed #7771: Grit plugins that use sequential no longer panic when Biome processes files.

#11766 c2542c6 Thanks @dyc3! - Fixed validation of readonly and accessor modifiers: combining them in either order now reports that they cannot be used together.
#11461 22e9966 Thanks @FoundDream! - Fixed #11423: Multiline template interpolations now preserve the indentation of their closing brace when the source indentation is not a multiple of tabWidth.
 const value = `
      ${
        condition
          ? "yes"
          : "no"
-}
+     }
 `;
#11766 c2542c6 Thanks @dyc3! - Fixed #11763: TypeScript class members using override accessor, such as override accessor value = 1, now parse correctly. The reversed order, accessor override, now reports that override must precede accessor.

#11790 17d0ff0 Thanks @ematipico! - Fixed #10248: noUselessFragments now allows fragments with props in Astro files, such as <Fragment slot="name">{text}</Fragment> inside template expressions.

... (truncated)

Commits

af4365d ci: release (#11711)
7ee3a6c fix(useExhaustiveSwitchCases): add option requireExplicitCase (#11777)
02ea438 feat(json_analyze): implement noJsonUnsafeValues (#9758)
64fd314 feat(json_analyze): implement useConsistentObjectKeys (#9797)
a9c4aa0 feat(html): detect undeclared custom Vue directives (#11651)
1fc17e3 feat: expand useIncludes (#11739)
71eaa0d feat(lint/html/svelte): add noSvelteAtDebugTags (#11754)
9bd70c7 fix: various bug fixes (#11735)
c7c4e2b fix(analyzer): various bugs (#11720)
5eb5f09 feat(biome_js_analyze): implement useValidTestTitle rule (#9176) (#11725)
Additional commits viewable in compare view

Updates @types/bun from 1.3.14 to 1.4.2

Commits

See full diff in compare view

Updates @valibot/to-json-schema from 1.7.1 to 1.8.0

Release notes

Sourced from @valibot/to-json-schema's releases.

v1.8.0 (to-json-schema)

Many thanks to @dylanpulver, @dzhu-amplify, @francisjohnjohnston-web, @idleberg, @jagregory, @lazerg, @LeSingh1, @MathurAditya724, @maximilliangrand, @MFA-G, @mrlubos, @rajanpanth, @sanjibani, @spokodev, @ysknsid25, and @yslpn for contributing to this release.

Add support for ksuid action (pull request #1370)

Add passthrough of other metadata action properties to support custom annotations and standard keywords like format, which take precedence over generated properties (pull request #1591)

Fix overlapping values, notValue and notValues actions to preserve all restrictions, including value actions for OpenAPI 3.0 (pull request #1613)

Fix value actions to report conflicting constant restrictions by default (pull request #1613)

Fix empty and duplicate requirements of values and notValues actions to produce valid enum restrictions or an impossible schema (pull request #1613)

Fix overlapping numeric, length, and object entry bounds to preserve the stricter constraints, including combinations with nonEmpty and safeInteger actions (pull request #1611)

Fix minValue, maxValue, gtValue and ltValue actions to reject NaN and infinite requirements by default and skip them in warn and ignore error modes (pull request #1611)

Fix length, minLength, maxLength, entries, minEntries and maxEntries actions to require non-negative integers by default and skip invalid requirements in warn and ignore error modes (pull request #1611)

Fix examples property type of JsonSchema to always be an array (pull request #1607)

Fix JSON compatibility validation of literal schemas to reject NaN and infinite numbers by default (pull request #1573)

Fix JSON compatibility validation of enum and picklist schemas to reject NaN and infinite numbers by default (pull request #1612)

Fix literal, enum and picklist schemas to skip unsupported values in warn and ignore error modes (pull request #1612)

Fix minValue, maxValue, gtValue and ltValue actions to skip numeric constraints on unsupported types in warn and ignore error modes (pull request #1595)

Fix generation of reference IDs for lazy schemas to produce consistent output and avoid collisions with existing definitions (pull request #1604)

Change ConversionContext.referenceMap type from Map to its ReferenceMap subclass (pull request #1604)

Change Valibot peer dependency to v1.5.0

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… updates Bumps the minor-and-patch group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@pulumi/pulumi](https://github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs) | `3.257.0` | `3.263.0` | | [es-toolkit](https://github.com/toss/es-toolkit) | `1.50.0` | `1.52.0` | | [valibot](https://github.com/open-circle/valibot) | `1.4.2` | `1.5.0` | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.8` | `2.5.14` | | [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) | `1.3.14` | `1.4.2` | | [@valibot/to-json-schema](https://github.com/open-circle/valibot) | `1.7.1` | `1.8.0` | Updates `@pulumi/pulumi` from 3.257.0 to 3.263.0 - [Release notes](https://github.com/pulumi/pulumi/releases) - [Changelog](https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md) - [Commits](https://github.com/pulumi/pulumi/commits/v3.263.0/sdk/nodejs) Updates `es-toolkit` from 1.50.0 to 1.52.0 - [Release notes](https://github.com/toss/es-toolkit/releases) - [Changelog](https://github.com/toss/es-toolkit/blob/main/CHANGELOG.md) - [Commits](toss/es-toolkit@v1.50.0...v1.52.0) Updates `valibot` from 1.4.2 to 1.5.0 - [Release notes](https://github.com/open-circle/valibot/releases) - [Commits](open-circle/valibot@v1.4.2...v1.5.0) Updates `@biomejs/biome` from 2.5.8 to 2.5.14 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.14/packages/@biomejs/biome) Updates `@types/bun` from 1.3.14 to 1.4.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun) Updates `@valibot/to-json-schema` from 1.7.1 to 1.8.0 - [Release notes](https://github.com/open-circle/valibot/releases) - [Commits](https://github.com/open-circle/valibot/commits) --- updated-dependencies: - dependency-name: "@pulumi/pulumi" dependency-version: 3.263.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: es-toolkit dependency-version: 1.52.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: valibot dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@biomejs/biome" dependency-version: 2.5.14 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/bun" dependency-version: 1.4.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@valibot/to-json-schema" dependency-version: 1.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-09-21T16:55:01Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1bc7178b-ecd7-48ad-8292-7cba495a8fc9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

dependabot · 2026-09-28T16:55:59Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 21, 2026

dependabot Bot closed this Sep 28, 2026

dependabot Bot deleted the dependabot/bun/minor-and-patch-509c5c9e7b branch September 28, 2026 16:56

Navigation Menu

Repository navigation

chore(deps): bump the minor-and-patch group across 1 directory with 6 updates - #21

chore(deps): bump the minor-and-patch group across 1 directory with 6 updates#21
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/minor-and-patch-509c5c9e7b

dependabot Bot commented on behalf of github Sep 21, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 21, 2026

Review skipped

Uh oh!

dependabot Bot commented on behalf of github Sep 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v3.263.0

3.263.0 (2026-09-15)

Bug Fixes

Improvements

Miscellaneous

v3.262.0

3.262.0 (2026-09-10)

Features

Bug Fixes

3.263.0 (2026-09-16)

Bug Fixes

Improvements

Miscellaneous

3.262.0 (2026-09-10)

Features

Bug Fixes

v1.52.0

v1.51.0

Version v1.52.0

Version v1.51.0

v1.5.0

v1.5.0 (to-json-schema)

Biome CLI v2.5.14

2.5.14

Patch Changes

2.5.14

Patch Changes

v1.8.0 (to-json-schema)

Uh oh!

coderabbitai Bot commented Sep 21, 2026

Review skipped

Uh oh!

dependabot Bot commented on behalf of github Sep 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 21, 2026 •

edited

Loading